mjml-group

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication integrity less transparent even though other maintenance signals are strong.

Repo package mentioncaution

The repository name does not match the package and its README does not mention mjml-group; while the name mismatch is normal for a monorepo subpackage, the lack of a README mention creates some uncertainty that the repository directly corresponds to the package.

Repo toolingcaution

The repository uses Babel and npm build tooling, but no security scanning tools were detected; the missing security automation is a modest transparency and defense-in-depth gap.

Security policycaution

No repository security policy was found, reducing documented vulnerability-reporting transparency, although active maintenance and workflow hygiene partly mitigate the concern.

Token permissionscaution

All three workflows lack top-level permissions declarations and none declares read-only permissions, leaving least-privilege behavior less explicit despite no top-level write declarations.